ANS-C01 Question 294
Single answerYour organization has an on-premises network and a VPC in AWS. You want to configure DNS resolution such that queries for 'internal.example.com' are resolved by your on-premises DNS servers, while all other DNS queries are resolved using Amazon Route 53 Resolver in the VPC. How should you configure this setup?
- A
Configure a Route 53 private hosted zone for 'internal.example.com' and associate it with the VPC.
- B
Set up a Route 53 Resolver inbound endpoint in the VPC and configure on-premises DNS servers to forward 'internal.example.com' queries to this endpoint.
- C
Create a Route 53 Resolver rule for conditional forwarding, specifying 'internal.example.com' and the on-premises DNS server IP address as the target.
- D
Use Amazon Route 53 Resolver outbound endpoint in the VPC and configure a forwarding rule for 'internal.example.com' to the on-premises DNS servers.
Show answer and explanation
Correct answer: C
Explanation
To resolve 'internal.example.com' queries using on-premises DNS servers while allowing other queries to be resolved by Route 53 Resolver, you must configure a Route 53 Resolver rule for conditional forwarding. This rule specifies the domain ('internal.example.com') and directs queries for this domain to the on-premises DNS servers. Using an outbound endpoint is necessary for DNS forwarding from the VPC, but it must be combined with a conditional forwarding rule to meet the requirements.
- A. Incorrect.
This is incorrect because a private hosted zone would require DNS records to be manually configured in Route 53. This approach does not forward queries to on-premises DNS servers, which is a key requirement in the scenario.
- B. Incorrect.
This is incorrect because an inbound endpoint is used to allow on-premises DNS servers to resolve DNS queries in the VPC, not for forwarding DNS queries from the VPC to on-premises servers.
- C. Correct.
This is correct because Route 53 Resolver rules for conditional forwarding allow you to direct DNS queries for specific domains to designated DNS servers, such as the on-premises DNS servers in this scenario.
- D. Incorrect.
This is incorrect because an outbound endpoint is required for forwarding DNS queries out of the VPC, but without a specific conditional forwarding rule, it won’t achieve the desired behavior for 'internal.example.com'.